A security team is deploying an NGFW to inspect traffic between on-premises users and cloud workloads. They need to enforce a policy that blocks the use of a specific social media application, even if it uses non-standard ports. They also want to log all attempts to access the application. Which NGFW feature should they configure?

Application identification and control

Intrusion prevention system (IPS)

Network address translation (NAT)

In a cloud environment, what is the primary purpose of a network ACL (Access Control List) as a firewall service?

To provide stateful filtering for individual virtual machines

To perform deep packet inspection and block malware

To provide subnet-level stateless traffic filtering

To encrypt traffic between subnets

A company has a policy that firewall rules must be reviewed every 90 days and any rule that has not been used in that period must be removed. The security team needs to implement this policy efficiently. What should they do?

Manually review the firewall configuration every 90 days and remove any rule that appears unnecessary.

Use a firewall rule optimizer that automatically removes rules based on traffic analysis.

Enable logging on all firewall rules and use a reporting tool to identify rules with no hits in the last 90 days.

Set a rule expiration date in the firewall management system for all rules.

A security team needs to inspect the contents of HTTPS traffic to detect data exfiltration attempts. They have deployed a next-generation firewall (NGFW) in line. What must they configure to enable the firewall to see the plaintext content?

SSL/TLS inspection with a trusted certificate installed on client devices

Port mirroring to send a copy of the traffic to the firewall

Stateful packet filtering to track the HTTPS sessions

Intrusion prevention system (IPS) signatures for HTTPS traffic

A security analyst is investigating a potential data exfiltration incident. The firewall logs show that a large amount of data was transferred to an external IP over HTTPS. The analyst suspects the data was hidden inside the encrypted payload. Which traffic inspection method would have been most likely to reveal this content?

Network address translation (NAT)

GIAC Cloud Security Architecture and Design

Domain 2Objective 3

Network Firewalls and Traffic Inspection GCAD Practice Questions (Page 5)

Part of the Network Architecture and Security domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

Questions 21–25

21application · medium
A security team is deploying an NGFW to inspect traffic between on-premises users and cloud workloads. They need to enforce a policy that blocks the use of a specific social media application, even if it uses non-standard ports. They also want to log all attempts to access the application. Which NGFW feature should they configure?
Select an answer first
22foundation · easy
In a cloud environment, what is the primary purpose of a network ACL (Access Control List) as a firewall service?
Select an answer first
23application · medium
A company has a policy that firewall rules must be reviewed every 90 days and any rule that has not been used in that period must be removed. The security team needs to implement this policy efficiently. What should they do?
Select an answer first
24application · medium
A security team needs to inspect the contents of HTTPS traffic to detect data exfiltration attempts. They have deployed a next-generation firewall (NGFW) in line. What must they configure to enable the firewall to see the plaintext content?
Select an answer first
25application · medium
A security analyst is investigating a potential data exfiltration incident. The firewall logs show that a large amount of data was transferred to an external IP over HTTPS. The analyst suspects the data was hidden inside the encrypted payload. Which traffic inspection method would have been most likely to reveal this content?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Network Firewalls and Traffic Inspection GCAD Practice Questions (Page 5)

Questions 21–25

In a cloud environment, what is the primary purpose of a network ACL (Access Control List) as a firewall service?

A company has a policy that firewall rules must be reviewed every 90 days and any rule that has not been used in that period must be removed. The security team needs to implement this policy efficiently. What should they do?

A security team needs to inspect the contents of HTTPS traffic to detect data exfiltration attempts. They have deployed a next-generation firewall (NGFW) in line. What must they configure to enable the firewall to see the plaintext content?

Keep studying — Network Architecture and Security